[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20200413145942.27686-1-levonshe@gmail.com>
Date: Mon, 13 Apr 2020 17:59:37 +0300
From: Lev Olshvang <levonshe@...il.com>
To: keescook@...omium.orh
Cc: kernel-hardening@...ts.openwall.com,
Lev Olshvang <levonshe@...il.com>
Subject: [PATCH v1 0/1] hardening : prevent write to proces's read-only pages
v2 --> v3
Split patch to architecture independ part and separate patches
for architectures that have arch_vma_access_permitted() handler.
I tested it only on arm and x86
v1 --> v2
I sent empty v1 patch, just resending
v0 --> v1
---
Added sysctl_forbid_write_ro_mem to control whether to allow write
or deny. (Advised by Kees Cook, KSPP issue 37)
It has values range [0-2] and it gets the initial value from
CONFIG_PROTECT_READONLY_USER_MEMORY (defaulted to 0, so it cant break)
Setting it to 0 disables write checks.
Setting it to 1 deny writes from other processes.
Setting it to 2 deny writes from any processes including itself
----
v0
----
The purpose of this patch is produce hardened kernel for Embedded
or Production systems.
This patch shouild close issue 37 opened by Kees Cook in KSPP project
Typically debuggers, such as gdb, write to read-only code [text]
sections of target process.(ptrace)
This kind of page protectiion violation raises minor page fault, but
kernel's fault handler allows it by default.
This is clearly attack surface for adversary.
The proposed kernel hardening configuration option checks the type of
protection of the foreign vma and blocks writes to read only vma.
When enabled, it will stop attacks modifying code or jump tables, etc.
Code of arch_vma_access_permitted() function was extended to
check foreign vma flags.
Tested on x86_64 and ARM(QEMU) with dd command which writes to
/proc/PID/mem in r--p or r--xp of vma area addresses range
dd reports IO failure when tries to write to adress taken from
from /proc/PID/maps (PLT or code section)
Lev Olshvang (1):
hardening: Do not allow writes to read-only process memory
arch/powerpc/include/asm/mmu_context.h | 16 ++++++------
arch/powerpc/mm/book3s64/pkeys.c | 8 +++---
arch/um/include/asm/mmu_context.h | 13 +++++-----
arch/unicore32/include/asm/mmu_context.h | 13 +++++-----
arch/x86/include/asm/mmu_context.h | 9 ++++---
arch/x86/mm/fault.c | 2 +-
include/asm-generic/mm_hooks.h | 12 ++++-----
include/linux/mm.h | 20 ++++++++++++++-
kernel/sysctl.c | 31 ++++++++++++++++--------
mm/util.c | 2 ++
security/Kconfig | 17 +++++++++----
11 files changed, 93 insertions(+), 50 deletions(-)
--
2.17.1
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
